port 6000 and 6001

[M.W. Chang]

>>     hits port
>>     ---- -----
>>       26	1736
>>       46	135
>>       68	445
>>      369	6001
>>      715	6000
> You didn't indicate if the connections were coming from inside (another
> system running X) or outside.  If coming from outside, it may be an
> attempt to compromise your X server (which runs as root).

Those calls came from outside. The ports were closed by a log-drop
iptable rule. I was just curious why there were so many calls to them
lately. I didn't see that many calls in previous months.

In previous months, the attacks focused on port 445 and NetBIOS.